CVE-2026-74999CWE-79cross-site-scripting

CVE-2026-74999

Medium · published August 17, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
28.7
In the wild
Unconfirmed
What it is

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00361 · 28.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-17T17:16Z
Affected products (2)
ProductVersionsFixed in
roundcube/webmail≥ 1.6.0, < 1.6.181.6.18
roundcube/webmail≥ 1.7.0, < 1.7.31.7.3
References (5)
https://github.com/roundcube/roundcubemail/commit/2d2a9604a820ee279c9ffcfe856b9b93a93995a8 · [email protected]https://github.com/roundcube/roundcubemail/commit/32f20c6bfd12dff9cfb6880ae303e740f0804fe8 · [email protected]https://github.com/roundcube/roundcubemail/releases/tag/1.6.18 · [email protected]https://github.com/roundcube/roundcubemail/releases/tag/1.7.3 · [email protected]https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3 · [email protected]
EPSS history
Timeline
  • 17 AUG 12:42Z
    In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS
    cvelistv5